Selesta Visual Access Manager Incorrect Access Control Vulnerability Allowing Arbitrary SQL Query Execution

A vulnerability exists in Selesta Visual Access Manager (VAM) versions prior to 4.42.2, where an authenticated user can access the administrative page '/common/vam_Sql.php'. This page permits the execution of arbitrary SQL queries, potentially leading to unauthorized data manipulation or disclosure.

Impact

Exploitation of this vulnerability could allow an authenticated user to execute arbitrary SQL queries, which may be used to manipulate or extract sensitive data from the application's database.